Analysis of NSL-KDD for the Implementation of Machine Learning in Network Intrusion Detection System

In the world of network data communication, anomaly detection is a crucial element in identifying abnormal behavior among the flowing data packets. Research in the field of intrusion detection often focuses on the search and analysis of anomalous patterns and the misuse of communication data. The research methodology in this study adopts CRISP-DM (Cross-Industry Standard Process for Data Mining) as the framework. The primary goal of this research is to conduct a comparative analysis of classification techniques to identify normal and anomaly records within network data. For this purpose, a publicly available standard dataset, NSL-KDD, is used. The NSL-KDD dataset consists of 41 attributes with relevance, and the 42nd attribute is used to identify normal class and four attack classes. The results of the analysis using the NSL-KDD dataset, applying the CRISP-DM methodology and machine learning techniques in the Network Intrusion Detection System, reveal that the Decision Tree model has the highest accuracy, achieving 100% on the training data and 80% on the testing data. These findings are compared with the results of using other models such as Random Forest, Logistic Regression, and K-Nearest Neighbor. This discovery has significant implications for enhancing NIDS's ability to recognize network threats and improve network system security.